Struct AskWatchdog 

pub struct AskWatchdog { /* private fields */ }

Cancelable wall-clock watchdog: on timeout, SIGTERM the child’s process group; escalate to SIGKILL after a 2s grace. Cancelable via an internal channel so a happy-path completion (the caller calls AskWatchdog::cancel before reaping) makes recv_timeout return Disconnected and the kill cascade is skipped — mirrors Python’s for t in timers: t.cancel() in the finally block.

Python parity: the providers only arm the watchdog when timeout > 0. A zero-duration timeout means “disabled” (caller opted out), NOT “immediate expiry”; Some(Duration::ZERO) is treated as None.

Implementations

impl AskWatchdog

pub fn spawn(pid: u32, timeout: Option<Duration>) -> Self

Arm a watchdog for pid (its process group). timeout == None or Some(ZERO) arms nothing.

pub fn cancel(&mut self)

Cancel the kill cascade (drop the sender). Call BEFORE reaping so a slow reap doesn’t run out the watchdog’s recv_timeout window.

pub fn join(&mut self)

Join the watchdog thread so its forensic state (the timed_out store) is committed before AskWatchdog::timed_out is read. Call AFTER reaping.

pub fn timed_out(&self) -> bool

Whether the watchdog fired (the child exceeded its wall-clock budget).

Call AskWatchdog::join FIRST: the watchdog thread stores the flag just after recv_timeout returns Timeout, so a read before the thread is joined can race and observe a stale false. Both run_codex and run_gemini reap → join() → timed_out() in that order.